Overview

overview

8

Static

static

3

2026-08-21...ed.exe

windows10-2004-x64

8

2026-08-21...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    37s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 08:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_a9fe423a9fc993c6dde37b0e73c71c42_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 30.5MB
  • Sample260822-kbhcdssflh
  • SHA256 7c8b33a261d823d57e358c8e751e0ab23fdf662ff6835e857a55cf663d569e14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_a9fe423a9fc993c6dde37b0e73c71c42_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_a9fe423a9fc993c6dde37b0e73c71c42_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4732
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_a9fe423a9fc993c6dde37b0e73c71c42_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_a9fe423a9fc993c6dde37b0e73c71c42_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.8MB
        • SHA256 00769751ecac82bbf839690b63a8785b562c5382dfa51cf611c9bed1c8f335b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 61.1MB
        • SHA256 ce78dbf0d3d39476c684f3b319c6606d16ac60623eec3e7be064c9c772e4230a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 65.2MB
        • SHA256 f5d26e0e15c33ce4ec29e9eab5adbe5ed5fb14ccd2bc8da4c5feff5f90c799db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 61.4MB
        • SHA256 d24afff6a6fba92d134a22c85bce6e63b93f1641c53e2f2dd036a8b273da2323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.7MB
        • SHA256 1b159b6f7ea7bf1366909588971fd781cc22755bafa387f1e7c9fdf822f21564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 61.2MB
        • SHA256 b9f2cddd7927ab298b30fd8d62fa5cc0872c1e112a0ccfbdc7a090895c1791df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 67.1MB
        • SHA256 f61cdd1280314b8d97db3b6aa29e786465e9e157dfcc2e170e2934aa218cf6b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 64.4MB
        • SHA256 b3b26c89d240d719fb1dc24b1cebe51ac95551ea668dbe5f9ee263e1406e1e79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.8MB
        • SHA256 460a1118f9edec3e6f84e0a2ad8bc7e5a5730e8357e6b9cad54d26b85c525577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.5MB
        • SHA256 333549fc5f706b2d332d8a67bc1b401d30efcb0f6da810338875d2a6943ad1b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 63.4MB
        • SHA256 7386fdb17faffc2d2b9d04864ea1c21163e386333a9e55754d5fe07e85f33508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 512KB
        • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 60.6MB
        • SHA256 bfd9989d2bbc9cd53018a80342fa62aa6adb1dbd1cb7db994ac6e8300c586ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 57.0MB
        • SHA256 25171eaeefdef53f63edf936eaee4f026752944a7158dabd992bfdcc9a16f1e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 56.4MB
        • SHA256 68c4cb92d47fdac8aa28810843d165e55a43466c82593a024a1c85f981949d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 56.5MB
        • SHA256 9ed62de2dbd9f39ffd5c263f4c787eeff217936b5aa77ee84b0ed5b128cf06b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 54.6MB
        • SHA256 e06de9fbd15c1d27115d8d400f5a0c4b940de2a038bfaec9909d0ca7bcb62b05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 52.7MB
        • SHA256 eeb078a87b8cc6743a7f46a9f109670c7cafa5018aa24310f801025c47367619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 52.8MB
        • SHA256 958510e9b0049abf97827f936e000b5259decd479c235d01b4e742710316d484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 52.1MB
        • SHA256 6afd9cf635be758b0ebbd2fb816ad4f1a145031eff212a7aaa81f7194c6e755f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.9MB
        • SHA256 5e462baae8f30b25e4f39eb8e8fcc618fd478649d2e7fbe987f2e07c98636928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 48.7MB
        • SHA256 0e136d33ad051fc9ae5d8951af2491694ddf6ab68f50b1aa4118f9664ac51ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.4MB
        • SHA256 85d9839040f9c616c4408736f36c50355c83d7fb3723f66d00977003a7a2117d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.2MB
        • SHA256 f39761105b6fb222564c358a3a0a7d92e120cda915999e5fea3347794381926f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.9MB
        • SHA256 86bffaa2063197764cb21a8bf62994dccb9697fb297d3fb3b74daf43116d40b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 45.0MB
        • SHA256 42833d7db1b5a10fc96fc51e4931201107ffa9e935a8f1ae53e016c88eee177a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 44.1MB
        • SHA256 18d5d0c3f8236344b847cd76c467e8f55f1b41ec42e65d3e40db1b0e8817a53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 43.2MB
        • SHA256 d668f5677293ab978bfa59f5aa1132d7fd8a243f6279c88248093c51493fdcb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 42.9MB
        • SHA256 f6b01c377eea61b67b67a3e7959b3da9a8a8ba94c1f0dca17a53f0734d8897e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 42.1MB
        • SHA256 33a4133f7b8ad6bc1b8e149a1430ac826970d1e42d8d4babf8d6b88d277bbb0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 41.9MB
        • SHA256 11885ceab5767a808e55a87551d30eaf84187babb24486f772f3fbcddb704259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 41.8MB
        • SHA256 d005fb6bc2ffd3841868fc6150cdf1511ab2f1cbdb33d7127380536ff608511e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.5MB
        • SHA256 b33ce9a54674f904eeb1d0779a85d74eb0b03c1e6e2e43fdd8f41ac2cc826fe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 40.1MB
        • SHA256 8dc69672c46aa22251801be809e7218d92d663c57e9bb057789b482bcc7b9b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 41.2MB
        • SHA256 d92b57d4a97c38ab190f6fb7b6cca17d17d33afb1c437e7a31e6cc15bc7cb6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.2MB
        • SHA256 1e44c3cd5d40ae4117d1577e91d168d4bd63150d545edba80148616ee500d9d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 41.0MB
        • SHA256 2463771c7c2371f18ff7f0f8af0b37cb01e8eae4ad2459bdd1d9c40e94d0ad84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.9MB
        • SHA256 6c14036feaa8816db7cc493f94a2069feeb0bf86b1b2709f3013d750392d7999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.8MB
        • SHA256 ad59e4c344d46e6a4fb54ec1e4281f583d7154699ff82623b793a406fbdfc2b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 40.6MB
        • SHA256 99c4810a5ce794485e5e8b41d8ea67aa4e359a95c0bf2d6b0e88a27a9ac9050d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 40.5MB
        • SHA256 55f33c835109843c6cd7167a8f73ab82cced2a042ee44720c2a00b924a181212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 40.3MB
        • SHA256 ce8ff57e54ee20595328460b3b06576edc65277a3a9a459a08ba746dd3289bfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 40.2MB
        • SHA256 7f1a6a07cebc41c1e95ef2a1b57e6b45429157cb7c5a83e39a339d37fe48df5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 61.2MB
        • SHA256 5c31eb2e9e5125d8f57808c9a4e5bb60c1ec35f7af1c7e19b2759dd99b7a5841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 61.1MB
        • SHA256 5d9e95ca6371508e88ebb7e1858f684a79617b46bd9e2678f9a41016340ea362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 61.2MB
        • SHA256 48edd967c8acbd6adb9a859539945e16efc0846dc507e3cb72c01e7737976d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 61.1MB
        • SHA256 c4bb0b408bad6a1e706a699990e4cf9d88c37018d2c5fcd288af8911524768f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1052-20-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4732-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4732-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download